CVE-2021-35464

🗓️ 22 Jul 2021 17:10:18Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1241 Views🌐 WEB

“CVE-2021-35464 ForgeRock AM server before 7.0 has Java deserialization vulnerability in jato.pageSession parameter

Reporter	Title	Published	Views	Family All 48
0day.today	ForgeRock Access Manager / OpenAM 14.6.3 - Remote Code Execution (Unauthenticated) Exploit	16 Jul 202100:00	–	zdt
GithubExploit	Exploit for Deserialization of Untrusted Data in Forgerock Access_Management	1 Jul 202103:51	–	githubexploit
ICS	2021 Top Routinely Exploited Vulnerabilities	28 Apr 202212:00	–	ics
ATTACKERKB	CVE-2026-33439	7 Apr 202620:46	–	attackerkb
ATTACKERKB	Pre-auth RCE in ForgeRock Access Manager (CVE-2021-35464)	22 Jul 202100:00	–	attackerkb
Information Security Automation	Last Week’s Security news: PrintNightmare, Kaseya, Intune, Metasploit Docker escape	5 Jul 202115:19	–	avleonov
Information Security Automation	Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins	19 Jul 202116:29	–	avleonov
BDU FSTEC	The vulnerability of the Access Management (AM) and OpenAM software tools, related to deficiencies in data deserialization mechanisms, allows attackers to execute arbitrary code.	17 Dec 202100:00	–	bdu_fstec
Circl	CVE-2021-35464	29 Jun 202113:17	–	circl
CISA KEV Catalog	ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability	3 Nov 202100:00	–	cisa_kev

NVD

Node

forgerock openamRange9.0.0–14.6.3

Source	Link
backstage	www.backstage.forgerock.com/knowledge/kb/article/a47894244
packetstormsecurity	www.packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html
bugster	www.bugster.forgerock.org/
packetstormsecurity	www.packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
jato.pageSession	request body	openam/ccversion/Version	Pre-auth deserialization in Jato allows RCE via crafted payload sent to the endpoint.	CWE-502
jato.pageSession	request body	openam/oauth2/..;/ccversion/Version	Bypass path traversal to reach vulnerable Jato endpoint enabling pre-auth RCE.	CWE-502
jato.pageSession	request body	ccversion/Version	Direct access to Jato Version endpoint vulnerable to pre-auth deserialization.	CWE-502
jato.pageSession	request body	OpenAM/ccversion/Version	Variant path to the vulnerable Jato endpoint (case-insensitive OpenAM path).	CWE-502

17 Jun 2026 03:57Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

CVSS 210

EPSS0.99999

SSVC